Data Processing Agreement

1. Subject matter, parties and precedence

The purpose of this Agreement is to govern the conditions under which AXPA Systems S.L.U. (Spanish tax ID B26941039, registered at CR. Baños de Arteixo, 33, 15008, A Coruña, Spain; hereinafter «AXPA» or the «Processor») processes personal data on behalf of the customer organisation using the Platform (hereinafter the «Customer» or the «Controller»). The Agreement applies to all services provided under the Terms and Conditions of Use and under any contract, order or subscription incorporating them. In the event of conflict between this Agreement and the Terms as regards personal data processed on behalf of the Customer, this Agreement prevails; in all other respects the Terms remain fully in force. Where the Customer and AXPA have executed a negotiated data processing agreement signed by both parties, that agreement prevails over this one.

2. Role of each party and excluded processing

AXPA acts as PROCESSOR in respect of third-party personal data that the Customer, its members or its integrations upload to the Platform in the course of their activity: pilots and staff of the organisation, contact details of the Customer's own end clients, flight logs and telemetry associated with identifiable individuals, records of ratings and training, and any other content the Customer chooses to store. The Customer is the Controller of that data and warrants that it has a valid legal basis for processing it and has informed the data subjects. By contrast, AXPA acts as an INDEPENDENT CONTROLLER in respect of account data, billing, platform security, support, product analytics and marketing communications, which fall OUTSIDE the scope of this Agreement and are governed by the Privacy Policy. This distinction is not a formality: it determines which processing the Customer may instruct and which it may not.

3. Duration of the processing mandate

The processing mandate begins when the Customer first uploads third-party personal data to the Platform and continues for as long as the contractual relationship remains in force, plus the grace and retention period set out in clause 26 of the Terms. Termination of the main contract terminates this Agreement, without prejudice to those obligations which by their nature must survive, in particular confidentiality and those in clause 13.

4. Documented instructions of the Controller

AXPA shall process personal data only on documented instructions from the Customer, including with regard to international transfers, unless required to do otherwise by Union or Member State law, in which case AXPA shall inform the Customer of that legal requirement before processing, unless that law prohibits it on important grounds of public interest. The following constitute documented instructions of the Customer: this Agreement, the Terms and Conditions, the configuration the Customer applies on the Platform and the use it makes of its features, and any additional instruction submitted in writing to the Data Protection Officer. AXPA shall inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions, and may suspend its execution until the Customer confirms, amends or withdraws it.

5. General obligations of the Processor

AXPA undertakes to: (a) process the data solely for the purposes of the contracted service and never for its own purposes; (b) NOT use the Customer's personal data to train, fine-tune or evaluate artificial intelligence models, algorithms or features, nor for statistical or product improvement purposes, save with the express, separate and revocable consent of the Customer, consistent with clause 22 of the Terms; (c) not disclose the data to third parties other than the sub-processors in clause 8, on the Customer's instruction or under a legal obligation; (d) maintain a written record of the categories of processing activities carried out on behalf of the Customer in accordance with Article 30(2) GDPR; and (e) appoint and maintain a data protection contact point, being the Data Protection Officer identified in clause 18.

6. Confidentiality of authorised personnel

AXPA warrants that the persons authorised to process personal data on behalf of the Customer have expressly committed themselves to confidentiality in writing, or are under an appropriate statutory obligation of confidentiality, and that such obligation survives the end of their relationship with AXPA. Access is granted on a least-privilege and need-to-know basis, is limited to personnel who require it in order to provide the service or support, and is withdrawn once that need ceases. AXPA further warrants that such personnel have received the necessary data protection training.

7. Security of processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, AXPA implements the appropriate technical and organisational measures required by Article 32 GDPR. Those measures are described in ANNEX II to this Agreement. AXPA may update them to incorporate technical improvements but may NOT degrade the overall level of security during the term of the Agreement. The Customer acknowledges that the configuration under its own control — management of members and roles, scope of organisational units, device and session policy, and the content it chooses to upload — forms part of overall security and is its responsibility.

8. Sub-processors and general authorisation

The Customer grants AXPA a GENERAL WRITTEN AUTHORISATION, within the meaning of Article 28(2) GDPR, to engage the sub-processors listed in ANNEX III to this Agreement. AXPA shall impose on each sub-processor, by contract, the same data protection obligations as those set out herein, and shall remain fully liable to the Customer for the performance of that sub-processor's obligations. Where AXPA intends to add a new sub-processor or replace an existing one, it shall notify the Customer at least THIRTY (30) CALENDAR DAYS in advance by updating Annex III together with a notice on the Platform or by email. During that period the Customer may object on reasonable, documented data protection grounds; if the parties fail to reach a solution, the Customer may terminate the affected part of the service without penalty and with a pro-rata refund of the unused period.

9. International transfers

Processing generally takes place within the European Economic Area: compute is deployed in the Frankfurt region and the databases and object storage reside in the European region of their respective providers. However, some providers are entities established outside the EEA whose personnel may access those systems remotely for support, engineering and security purposes, which constitutes an international transfer. Every transfer relies on a Chapter V GDPR mechanism, identified provider by provider in ANNEX III: the adequacy decision applicable to the destination country (Article 45), the EU-US Data Privacy Framework, or the Standard Contractual Clauses approved by Implementing Decision (EU) 2021/914 (Article 46(2)(c)), supplemented where appropriate by additional measures. AXPA shall not carry out transfers other than those provided for without the Customer's prior instruction or authorisation.

10. Assistance with data subject rights

AXPA shall assist the Customer, taking into account the nature of the processing and by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests to exercise the rights of access, rectification, erasure, restriction, portability and objection, as well as the right not to be subject to automated decision-making. The Platform provides self-service functionality — viewing, editing, exporting and deleting records — enabling the Customer to handle most such requests directly. If a data subject addresses a request to AXPA rather than to the Customer, AXPA shall not respond on its own initiative: it shall forward the request to the Customer without undue delay and in any event within FIVE (5) BUSINESS DAYS of receipt.

11. Assistance with security, impact assessments and prior consultation

AXPA shall provide the Customer with reasonable assistance, taking into account the nature of the processing and the information available to it, in complying with the obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation of the supervisory authority. Such assistance shall be provided at no additional cost where it consists of supplying documentation already prepared or information about security measures; assistance requiring bespoke development or extraordinary effort may be charged at the applicable rates, subject to prior notice to and acceptance by the Customer.

12. Personal data breaches

AXPA shall notify the Customer of any breach of the security of personal data processed on its behalf WITHOUT UNDUE DELAY after becoming aware of it, and in any event within FORTY-EIGHT (48) HOURS, by email to the contact address of the organisation owner and by notice on the Platform. The notification shall describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and the contact details of the Data Protection Officer. Where it is not possible to provide all the information at the same time, it shall be provided in phases without undue delay. It is for the CUSTOMER, as Controller, to decide upon and carry out notification to the supervisory authority and to data subjects; AXPA shall not do so on its behalf save on express instruction.

13. Return or deletion of data on termination

On termination of the provision of services, and at the Customer's choice, AXPA shall delete the personal data processed on its behalf or return it, and shall delete existing copies, unless Union or Member State law requires its retention. The Customer may exercise the return option at any time while the service is active and during the subsequent grace period, using the Platform's export functions or by requesting an extraction from the Data Protection Officer; once that period has elapsed, AXPA shall proceed to deletion in accordance with clause 26 of the Terms. Backups are overwritten in the ordinary rotation cycles of the database provider: during that interval the data is blocked and is not subject to any processing other than storage.

14. Audits and making information available

AXPA shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by it. The Customer shall give at least THIRTY (30) CALENDAR DAYS' notice, limit audits to once per calendar year — unless there has been a substantiated security breach or a supervisory authority so requires, in which case that limit does not apply —, conduct them during business hours without disrupting operations, and place the auditor under a confidentiality undertaking. The auditor may not be a competitor of AXPA. AXPA may satisfy the request by providing current certifications, third-party audit reports or completed security questionnaires, provided these reasonably address the subject matter of the audit. The costs of the audit are borne by the Customer, unless it reveals a material breach attributable to AXPA.

15. Obligations of the Controller

The Customer warrants that: (a) the processing it instructs has a valid legal basis and complies with the principles of Article 5 GDPR, in particular data minimisation; (b) it has informed data subjects in accordance with Articles 13 and 14 and, where applicable, obtained their consent; (c) its instructions are lawful and do not require AXPA to infringe the applicable rules; (d) it keeps the list of members of its organisation and their permissions up to date, and promptly revokes access that is no longer necessary; and (e) it shall not upload to the Platform special categories of data under Article 9 or data relating to criminal convictions and offences under Article 10 without prior written agreement with AXPA, as the Platform is neither designed nor scoped to process them.

16. Liability

Each party is liable for damage caused by processing which infringes the GDPR on the terms of Article 82. AXPA's liability arising from this Agreement is subject to the same monetary caps and exclusions agreed in clause 29 of the Terms, except where applicable law does not permit such limitation and without affecting liability towards data subjects or supervisory authorities, which is governed by the GDPR. The Customer shall hold AXPA harmless against claims arising from the absence of a legal basis, from failure to inform data subjects, or from the unlawfulness of its instructions.

17. Term, amendment and termination

This Agreement enters into force upon commencement of the processing mandate and remains in force for as long as the processing lasts. AXPA may amend it to adapt it to regulatory changes, to decisions or guidance from supervisory authorities, or to changes in the service architecture, by publishing the updated version with a new date at this same address and notifying the Customer. Amendments that materially reduce the Customer's safeguards entitle it to terminate the affected part of the service without penalty within thirty days of the notification. Updates to Annex III are governed by the specific procedure in clause 8.

18. Governing law, supervisory authority and contact

This Agreement is governed by Spanish law and by Regulation (EU) 2016/679, and disputes are submitted to the courts provided for in clause 37 of the Terms. The supervisory authority competent in respect of AXPA is the Spanish Data Protection Agency (www.aepd.es), without prejudice to the authority competent in respect of the Customer. All communications relating to this Agreement — requests for a signed counterpart, additional instructions, objection to a sub-processor, audit requests and notifications — shall be addressed to the Data Protection Officer of AXPA Systems S.L.U., Pablo Menéndez-Ponte Alonso, at admin@axpa.app.

Annex II — Technical and organisational measures

Measures applied by AXPA in accordance with Article 32 GDPR. The description reflects the actual architecture of the Platform and is updated when it changes, without the overall level of security being allowed to degrade during the term of the Agreement.

• Encryption in transit: all communication with the Platform takes place over HTTPS with TLS. No cleartext endpoint is offered.
• Encryption at rest: the database and object storage apply the encryption managed by their respective providers. Passwords are never stored in cleartext, but as a salted cryptographic digest.
• Tenant isolation: every record belongs to an organisation and the data-layer access rules filter by it on every query, so isolation does not depend on the interface hiding the data, but on the query not returning it.
• Granular access control: the authorisation model is based on permissions per functional domain rather than on a role hierarchy, with both system roles and roles owned by each organisation. Organisations with an internal hierarchy may further confine each member to their unit or subtree.
• Strong authentication: support for a second factor and for federated identity. Access to the platform administration panel is restricted to global administrators and mandatorily requires a second factor, with no way to bypass it.
• Session and device management: sessions expire, are recorded individually and can be revoked remotely. The number of simultaneous devices and sessions is capped by plan, which bounds the impact of a compromised credential.
• Rate limiting on sensitive endpoints — authentication, verification and one-time codes — to contain brute-force and enumeration attacks.
• Automated static security auditing, wired in as a quality gate both in code review and in the production build: a critical or high finding halts the deployment before it reaches the database.
• Traceability: logging of email dispatches, active sessions and account lifecycle events, retained so that an incident can be investigated.
• Backups and recovery managed by the database provider, with point-in-time recovery within the retention window of its plan.
• Minimisation and separation of purposes: Customer content is not used to train models or improve the product without express, separate consent, in accordance with clause 5(b).
• Organisational measures: least-privilege access, written confidentiality undertakings from authorised personnel, data protection training and the appointment of a Data Protection Officer as single point of contact.